Low-Priv Auth Code Injection in NVIDIA UFM Enterprise Plugin API
CVE-2026-24169 Published on August 25, 2026
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
Vulnerability Analysis
Weakness Type
What is a Command Injection Vulnerability?
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2026-24169 has been classified to as a Command Injection vulnerability or weakness.
Affected Versions
NVIDIA Unified Fabric Manager Enterprise - GA:- Version All GA versions prior to 6.24.1-5 is affected.
- Version All LTS versions prior to 6.23.20-3 is affected.
- Version All LTS versions prior to 6.19.15 is affected.
- Version All LTS versions prior to 6.15.17 is affected.